Attackers Automate, Defenders Automate Back

The arms race has reached its automation phase. Attackers use language models to produce phishing that reads fluently in any language and reconnaissance that scales across thousands of targets, while defenders deploy their own automation to keep the resulting alert volume within human capacity.

The attacker advantage is volume; the defender advantage is context. Machine-crafted lures are better written but still arrive without the internal knowledge that defenders can encode: who actually emails whom, what requests are normal, which systems never talk. Security products increasingly compete on how well they model that context.

Inside security operations, automation has moved from enrichment to action. Triage agents close the routine majority of alerts, draft investigations for the remainder, and execute containment steps under human approval, changing analyst work from queue-clearing to supervision.

The uncomfortable equilibrium is that both sides get more productive and the contest continues at higher speed. Veterans of the field find the pattern familiar; the tools change, the asymmetry persists, and the organizations that drill their fundamentals still fare best when the automation on both sides has done its work.